CISC-RT-000010 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-220986r622190_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-110793

STIG-Legacy|V-101689

Vuln-ID|V-220986

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols.

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-220987r856398_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-110795

STIG-Legacy|V-101691

Vuln-ID|V-220987

CISC-RT-000030 - The Cisco switch must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-220988r856399_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-110797

STIG-Legacy|V-101693

Vuln-ID|V-220988

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication.

CCI|CCI-000803

Rule-ID|SV-220989r894624_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-110799

STIG-Legacy|V-101695

Vuln-ID|V-220989

CISC-RT-000050 - The Cisco switch must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-220990r622190_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-110801

STIG-Legacy|V-101697

Vuln-ID|V-220990

CISC-RT-000060 - The Cisco switch must be configured to have all inactive layer 3 interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-220991r622190_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-110803

STIG-Legacy|V-101699

Vuln-ID|V-220991

CISC-RT-000090 - The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-220994r856401_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-110809

STIG-Legacy|V-101705

Vuln-ID|V-220994

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Rule-ID|SV-220995r856402_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-110811

STIG-Legacy|V-101707

Vuln-ID|V-220995

CISC-RT-000130 - The Cisco switch must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-220996r622190_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-110813

STIG-Legacy|V-101709

Vuln-ID|V-220996

CISC-RT-000140 - The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-220997r622190_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-110815

STIG-Legacy|V-101711

Vuln-ID|V-220997

CISC-RT-000150 - The Cisco switch must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-220998r856403_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-110817

STIG-Legacy|V-101713

Vuln-ID|V-220998

CISC-RT-000160 - The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-220999r856404_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-110819

STIG-Legacy|V-101715

Vuln-ID|V-220999

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces

Rule-ID|SV-221000r856405_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-110821

STIG-Legacy|V-101717

Vuln-ID|V-221000

CISC-RT-000180 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-221001r856406_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-110823

STIG-Legacy|V-101719

Vuln-ID|V-221001

CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-221002r856407_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-110825

STIG-Legacy|V-101721

Vuln-ID|V-221002

CISC-RT-000200 - The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL.

CCI|CCI-000134

Rule-ID|SV-221003r622190_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-110827

STIG-Legacy|V-101723

Vuln-ID|V-221003

CISC-RT-000210 - The Cisco switch must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-221004r622190_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-110829

STIG-Legacy|V-101725

Vuln-ID|V-221004

CISC-RT-000220 - The Cisco switch must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-221005r622190_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-110831

STIG-Legacy|V-101727

Vuln-ID|V-221005

CISC-RT-000230 - The Cisco switch must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-221006r622190_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-110833

STIG-Legacy|V-101729

Vuln-ID|V-221006

CISC-RT-000235 - The Cisco switch must be configured to have Cisco Express Forwarding enabled

Rule-ID|SV-237750r648776_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-237750

CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-237752r648780_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-237752

CISC-RT-000237 - The Cisco switch must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-237756r648787_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-237756

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception

CCI|CCI-001109

Rule-ID|SV-221007r622190_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-110835

STIG-Legacy|V-101731

Vuln-ID|V-221007

CISC-RT-000250 - The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-221008r622190_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-110837

STIG-Legacy|V-101733

Vuln-ID|V-221008

CISC-RT-000260 - The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-221009r856408_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-110839

STIG-Legacy|V-101735

Vuln-ID|V-221009

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes

Rule-ID|SV-221010r863263_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-110841

STIG-Legacy|V-101737

Vuln-ID|V-221010

CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-221011r622190_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-110843

STIG-Legacy|V-101739

Vuln-ID|V-221011

CISC-RT-000320 - The Cisco perimeter switch must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-221012r622190_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-110845

STIG-Legacy|V-101741

Vuln-ID|V-221012

CISC-RT-000330 - The Cisco perimeter switch must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-221013r622190_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-110847

STIG-Legacy|V-101743

Vuln-ID|V-221013

CISC-RT-000340 - The Cisco perimeter switch must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-221014r622190_rule

STIG-ID|CISC-RT-000340

STIG-Legacy|SV-110849

STIG-Legacy|V-101745

Vuln-ID|V-221014

CISC-RT-000350 - The Cisco perimeter switch must be configured to block all packets with any IP options.

Rule-ID|SV-221015r856410_rule

STIG-ID|CISC-RT-000350

STIG-Legacy|SV-110851

STIG-Legacy|V-101747

Vuln-ID|V-221015

CISC-RT-000360 - The Cisco perimeter switch must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-221016r856411_rule

STIG-ID|CISC-RT-000360

STIG-Legacy|SV-110853

STIG-Legacy|V-101749

Detections

Analytics

DISA STIG Cisco IOS XE Switch RTR v2r4

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous